@reallyme/crypto 0.3.9 → 0.3.11

package/dist/protoIdentifiers.js

@@ -0,0 +1,112 @@
+// SPDX-FileCopyrightText: 2026 ReallyMe LLC
+//
+// SPDX-License-Identifier: MIT OR Apache-2.0
+import { create } from "@bufbuild/protobuf";
+import { ReallyMeCryptoError } from "./errors.js";
+import { hpkeSuiteFromProto, hpkeSuiteToProto, kemAlgorithmFromProto, kemAlgorithmToProto, keyAgreementAlgorithmFromProto, keyAgreementAlgorithmToProto, signatureAlgorithmFromProto, signatureAlgorithmToProto, } from "./protoAlgorithms.js";
+import { CryptoAlgorithmIdentifierSchema, MulticodecKeyAlgorithm, } from "./proto/generated/reallyme/crypto/v1/crypto_pb.js";
+export const signatureAlgorithmIdentifierToProto = (value) => create(CryptoAlgorithmIdentifierSchema, {
+    algorithm: { case: "signature", value: signatureAlgorithmToProto(value) },
+});
+export const keyAgreementAlgorithmIdentifierToProto = (value) => create(CryptoAlgorithmIdentifierSchema, {
+    algorithm: { case: "keyAgreement", value: keyAgreementAlgorithmToProto(value) },
+});
+export const kemAlgorithmIdentifierToProto = (value) => create(CryptoAlgorithmIdentifierSchema, {
+    algorithm: { case: "kem", value: kemAlgorithmToProto(value) },
+});
+export const hpkeSuiteIdentifierToProto = (value) => create(CryptoAlgorithmIdentifierSchema, {
+    algorithm: { case: "hpkeSuite", value: hpkeSuiteToProto(value) },
+});
+export const signatureAlgorithmFromIdentifier = (value) => {
+    if (value?.algorithm.case !== "signature") {
+        throw new ReallyMeCryptoError("invalid-input");
+    }
+    return signatureAlgorithmFromProto(value.algorithm.value);
+};
+export const keyAgreementAlgorithmFromIdentifier = (value) => {
+    if (value?.algorithm.case !== "keyAgreement") {
+        throw new ReallyMeCryptoError("invalid-input");
+    }
+    return keyAgreementAlgorithmFromProto(value.algorithm.value);
+};
+export const kemAlgorithmFromIdentifier = (value) => {
+    if (value?.algorithm.case !== "kem") {
+        throw new ReallyMeCryptoError("invalid-input");
+    }
+    return kemAlgorithmFromProto(value.algorithm.value);
+};
+export const hpkeSuiteFromIdentifier = (value) => {
+    if (value?.algorithm.case !== "hpkeSuite") {
+        throw new ReallyMeCryptoError("invalid-input");
+    }
+    return hpkeSuiteFromProto(value.algorithm.value);
+};
+export const multicodecKeyAlgorithmFromProto = (value) => {
+    switch (value) {
+        case MulticodecKeyAlgorithm.ED25519_PUB:
+            return "ed25519-pub";
+        case MulticodecKeyAlgorithm.X25519_PUB:
+            return "x25519-pub";
+        case MulticodecKeyAlgorithm.SECP256K1_PUB:
+            return "secp256k1-pub";
+        case MulticodecKeyAlgorithm.P256_PUB:
+            return "p256-pub";
+        case MulticodecKeyAlgorithm.P384_PUB:
+            return "p384-pub";
+        case MulticodecKeyAlgorithm.P521_PUB:
+            return "p521-pub";
+        case MulticodecKeyAlgorithm.ED448_PUB:
+            return "ed448-pub";
+        case MulticodecKeyAlgorithm.RSA_PUB:
+            return "rsa-pub";
+        case MulticodecKeyAlgorithm.ML_KEM_512_PUB:
+            return "mlkem-512-pub";
+        case MulticodecKeyAlgorithm.ML_KEM_768_PUB:
+            return "mlkem-768-pub";
+        case MulticodecKeyAlgorithm.ML_KEM_1024_PUB:
+            return "mlkem-1024-pub";
+        case MulticodecKeyAlgorithm.ML_DSA_44_PUB:
+            return "mldsa-44-pub";
+        case MulticodecKeyAlgorithm.ML_DSA_65_PUB:
+            return "mldsa-65-pub";
+        case MulticodecKeyAlgorithm.ML_DSA_87_PUB:
+            return "mldsa-87-pub";
+        default:
+            throw new ReallyMeCryptoError("unsupported-algorithm");
+    }
+};
+export const multicodecKeyAlgorithmToProto = (value) => {
+    switch (value) {
+        case "ed25519-pub":
+            return MulticodecKeyAlgorithm.ED25519_PUB;
+        case "x25519-pub":
+            return MulticodecKeyAlgorithm.X25519_PUB;
+        case "secp256k1-pub":
+            return MulticodecKeyAlgorithm.SECP256K1_PUB;
+        case "p256-pub":
+            return MulticodecKeyAlgorithm.P256_PUB;
+        case "p384-pub":
+            return MulticodecKeyAlgorithm.P384_PUB;
+        case "p521-pub":
+            return MulticodecKeyAlgorithm.P521_PUB;
+        case "ed448-pub":
+            return MulticodecKeyAlgorithm.ED448_PUB;
+        case "rsa-pub":
+            return MulticodecKeyAlgorithm.RSA_PUB;
+        case "mlkem-512-pub":
+            return MulticodecKeyAlgorithm.ML_KEM_512_PUB;
+        case "mlkem-768-pub":
+            return MulticodecKeyAlgorithm.ML_KEM_768_PUB;
+        case "mlkem-1024-pub":
+            return MulticodecKeyAlgorithm.ML_KEM_1024_PUB;
+        case "mldsa-44-pub":
+            return MulticodecKeyAlgorithm.ML_DSA_44_PUB;
+        case "mldsa-65-pub":
+            return MulticodecKeyAlgorithm.ML_DSA_65_PUB;
+        case "mldsa-87-pub":
+            return MulticodecKeyAlgorithm.ML_DSA_87_PUB;
+    }
+};
+// The largest supported canonical JWK is below 4 KiB. Keeping a full factor of
+// two for future public-key encodings prevents attacker-controlled allocations
+// and guarantees conversion never depends on an engine's argument-count limit.

package/dist/protoJwk.d.ts

@@ -0,0 +1,10 @@
+import type { ReallyMeJwkKey, ReallyMeJwksKeySet } from "./jwk.js";
+import type { JsonWebKey, JsonWebKeySet } from "./proto/generated/reallyme/crypto/v1/crypto_pb.js";
+export declare const jsonWebKeyToProto: (key: ReallyMeJwkKey) => JsonWebKey;
+export declare const jsonWebKeyToProtoBytes: (key: ReallyMeJwkKey) => Uint8Array;
+export declare const jsonWebKeyFromProto: (value: JsonWebKey) => ReallyMeJwkKey;
+export declare const jsonWebKeyFromProtoBytes: (bytes: Uint8Array) => ReallyMeJwkKey;
+export declare const jsonWebKeySetToProto: (keySet: ReallyMeJwksKeySet) => JsonWebKeySet;
+export declare const jsonWebKeySetToProtoBytes: (keySet: ReallyMeJwksKeySet) => Uint8Array;
+export declare const jsonWebKeySetFromProto: (value: JsonWebKeySet) => ReallyMeJwksKeySet;
+export declare const jsonWebKeySetFromProtoBytes: (bytes: Uint8Array) => ReallyMeJwksKeySet;

package/dist/protoJwk.js

@@ -0,0 +1,204 @@
+// SPDX-FileCopyrightText: 2026 ReallyMe LLC
+//
+// SPDX-License-Identifier: MIT OR Apache-2.0
+import { create, fromBinary, toBinary } from "@bufbuild/protobuf";
+import { ReallyMeCryptoError } from "./errors.js";
+import { MAX_JWKS_KEYS, ReallyMeJwk } from "./jwk.js";
+import { ensureByteArrayAtMost, MAX_CRYPTO_INPUT_LENGTH, } from "./validateBytes.js";
+import { CryptoAlgorithmIdentifierSchema, JsonWebKeySchema, JsonWebKeySetSchema, KemAlgorithm, KeyAgreementAlgorithm, SignatureAlgorithm, } from "./proto/generated/reallyme/crypto/v1/crypto_pb.js";
+const MAX_JWK_CANONICAL_JCS_LENGTH = 8_192;
+const asciiToBytes = (value) => {
+    if (value.length > MAX_JWK_CANONICAL_JCS_LENGTH) {
+        throw new ReallyMeCryptoError("invalid-input");
+    }
+    const bytes = new Uint8Array(value.length);
+    for (let index = 0; index < value.length; index += 1) {
+        const codeUnit = value.charCodeAt(index);
+        if (codeUnit > 0x7f) {
+            throw new ReallyMeCryptoError("invalid-input");
+        }
+        bytes[index] = codeUnit;
+    }
+    return bytes;
+};
+const asciiFromBytes = (value) => {
+    ensureByteArrayAtMost(value, MAX_JWK_CANONICAL_JCS_LENGTH);
+    const characters = [];
+    for (const byte of value) {
+        if (byte > 0x7f) {
+            throw new ReallyMeCryptoError("invalid-input");
+        }
+        characters.push(String.fromCharCode(byte));
+    }
+    return characters.join("");
+};
+const withJwkProtoBoundaryErrors = (operation) => {
+    try {
+        return operation();
+    }
+    catch (error) {
+        if (error instanceof ReallyMeCryptoError) {
+            throw error;
+        }
+        throw new ReallyMeCryptoError("invalid-input");
+    }
+};
+const signatureJwkAlgorithmToProto = (value) => {
+    switch (value) {
+        case "Ed25519":
+            return SignatureAlgorithm.ED25519;
+        case "P-256":
+            return SignatureAlgorithm.ECDSA_P256_SHA256;
+        case "secp256k1":
+            return SignatureAlgorithm.ECDSA_SECP256K1_SHA256;
+        case "ML-DSA-44":
+            return SignatureAlgorithm.ML_DSA_44;
+        case "ML-DSA-65":
+            return SignatureAlgorithm.ML_DSA_65;
+        case "ML-DSA-87":
+            return SignatureAlgorithm.ML_DSA_87;
+        case "SLH-DSA-SHA2-128s":
+            return SignatureAlgorithm.SLH_DSA_SHA2_128S;
+        default:
+            throw new ReallyMeCryptoError("unsupported-algorithm");
+    }
+};
+const jwkAlgorithmToProto = (value) => {
+    switch (value) {
+        case "X25519":
+            return create(CryptoAlgorithmIdentifierSchema, {
+                algorithm: {
+                    case: "keyAgreement",
+                    value: KeyAgreementAlgorithm.X25519,
+                },
+            });
+        case "ML-KEM-512":
+            return create(CryptoAlgorithmIdentifierSchema, {
+                algorithm: {
+                    case: "kem",
+                    value: KemAlgorithm.ML_KEM_512,
+                },
+            });
+        case "ML-KEM-768":
+            return create(CryptoAlgorithmIdentifierSchema, {
+                algorithm: {
+                    case: "kem",
+                    value: KemAlgorithm.ML_KEM_768,
+                },
+            });
+        case "ML-KEM-1024":
+            return create(CryptoAlgorithmIdentifierSchema, {
+                algorithm: {
+                    case: "kem",
+                    value: KemAlgorithm.ML_KEM_1024,
+                },
+            });
+        case "X-Wing-768":
+            return create(CryptoAlgorithmIdentifierSchema, {
+                algorithm: {
+                    case: "kem",
+                    value: KemAlgorithm.X_WING_768,
+                },
+            });
+        default:
+            return create(CryptoAlgorithmIdentifierSchema, {
+                algorithm: {
+                    case: "signature",
+                    value: signatureJwkAlgorithmToProto(value),
+                },
+            });
+    }
+};
+const signatureJwkAlgorithmFromProto = (value) => {
+    switch (value) {
+        case SignatureAlgorithm.ED25519:
+            return "Ed25519";
+        case SignatureAlgorithm.ECDSA_P256_SHA256:
+            return "P-256";
+        case SignatureAlgorithm.ECDSA_SECP256K1_SHA256:
+            return "secp256k1";
+        case SignatureAlgorithm.ML_DSA_44:
+            return "ML-DSA-44";
+        case SignatureAlgorithm.ML_DSA_65:
+            return "ML-DSA-65";
+        case SignatureAlgorithm.ML_DSA_87:
+            return "ML-DSA-87";
+        case SignatureAlgorithm.SLH_DSA_SHA2_128S:
+            return "SLH-DSA-SHA2-128s";
+        default:
+            throw new ReallyMeCryptoError("unsupported-algorithm");
+    }
+};
+const jwkAlgorithmFromProto = (value) => {
+    switch (value.algorithm.case) {
+        case "signature":
+            return signatureJwkAlgorithmFromProto(value.algorithm.value);
+        case "keyAgreement":
+            if (value.algorithm.value === KeyAgreementAlgorithm.X25519) {
+                return "X25519";
+            }
+            throw new ReallyMeCryptoError("unsupported-algorithm");
+        case "kem":
+            switch (value.algorithm.value) {
+                case KemAlgorithm.ML_KEM_512:
+                    return "ML-KEM-512";
+                case KemAlgorithm.ML_KEM_768:
+                    return "ML-KEM-768";
+                case KemAlgorithm.ML_KEM_1024:
+                    return "ML-KEM-1024";
+                case KemAlgorithm.X_WING_768:
+                    return "X-Wing-768";
+                default:
+                    throw new ReallyMeCryptoError("unsupported-algorithm");
+            }
+        default:
+            throw new ReallyMeCryptoError("unsupported-algorithm");
+    }
+};
+export const jsonWebKeyToProto = (key) => create(JsonWebKeySchema, {
+    algorithm: jwkAlgorithmToProto(key.algorithm),
+    publicKey: key.publicKey,
+    canonicalJcs: asciiToBytes(ReallyMeJwk.toJcs(key.jwk)),
+});
+export const jsonWebKeyToProtoBytes = (key) => toBinary(JsonWebKeySchema, jsonWebKeyToProto(key));
+export const jsonWebKeyFromProto = (value) => withJwkProtoBoundaryErrors(() => {
+    // Read each field once so a hostile message proxy cannot change values
+    // between validation and construction.
+    const algorithmValue = value.algorithm;
+    const publicKey = value.publicKey;
+    const canonicalJcs = value.canonicalJcs;
+    const algorithm = algorithmValue === undefined
+        ? undefined
+        : jwkAlgorithmFromProto(algorithmValue);
+    if (algorithm === undefined) {
+        throw new ReallyMeCryptoError("invalid-input");
+    }
+    ensureByteArrayAtMost(publicKey, MAX_CRYPTO_INPUT_LENGTH);
+    const jwk = ReallyMeJwk.toJwk(algorithm, publicKey);
+    if (canonicalJcs.length > 0) {
+        const expected = ReallyMeJwk.toJcs(jwk);
+        if (asciiFromBytes(canonicalJcs) !== expected) {
+            throw new ReallyMeCryptoError("invalid-input");
+        }
+    }
+    return { algorithm, publicKey, jwk };
+});
+export const jsonWebKeyFromProtoBytes = (bytes) => withJwkProtoBoundaryErrors(() => {
+    ensureByteArrayAtMost(bytes, MAX_CRYPTO_INPUT_LENGTH);
+    return jsonWebKeyFromProto(fromBinary(JsonWebKeySchema, bytes));
+});
+export const jsonWebKeySetToProto = (keySet) => create(JsonWebKeySetSchema, {
+    keys: keySet.keys.map((key) => jsonWebKeyToProto(key)),
+});
+export const jsonWebKeySetToProtoBytes = (keySet) => toBinary(JsonWebKeySetSchema, jsonWebKeySetToProto(keySet));
+export const jsonWebKeySetFromProto = (value) => withJwkProtoBoundaryErrors(() => {
+    const keys = value.keys;
+    if (!Array.isArray(keys) || keys.length > MAX_JWKS_KEYS) {
+        throw new ReallyMeCryptoError("invalid-input");
+    }
+    return { keys: keys.map((key) => jsonWebKeyFromProto(key)) };
+});
+export const jsonWebKeySetFromProtoBytes = (bytes) => withJwkProtoBoundaryErrors(() => {
+    ensureByteArrayAtMost(bytes, MAX_CRYPTO_INPUT_LENGTH);
+    return jsonWebKeySetFromProto(fromBinary(JsonWebKeySetSchema, bytes));
+});

package/dist/protoValues.d.ts

@@ -0,0 +1,63 @@
+import type { ReallyMeHpkeSuite, ReallyMeKemAlgorithm, ReallyMeKeyAgreementAlgorithm, ReallyMeSignatureAlgorithm } from "./algorithms.js";
+import type { ReallyMeHpkeSealedMessage, ReallyMeKemEncapsulation, ReallyMeKemKeyPair, ReallyMeKeyAgreementKeyPair, ReallyMeSignatureKeyPair } from "./cryptoFacade.js";
+import { ReallyMeCryptoError } from "./errors.js";
+import { CryptoAlgorithmFamily } from "./proto/generated/reallyme/crypto/v1/crypto_pb.js";
+import type { CryptoAlgorithmIdentifier, CryptoHpkeSealedMessage, CryptoKemEncapsulation, CryptoKeyPair, CryptoProviderCapability, CryptoProviderCapabilitySet, CryptoVerificationResult } from "./proto/generated/reallyme/crypto/v1/crypto_pb.js";
+export type ReallyMeProviderSupportStatus = "partial" | "provider-aware" | "supported" | "unsupported";
+export type ReallyMeProviderCapability = Readonly<{
+    algorithm: CryptoAlgorithmIdentifier;
+    family: CryptoAlgorithmFamily;
+    providerNames: ReadonlyArray<string>;
+    status: ReallyMeProviderSupportStatus;
+    usesRust: boolean;
+}>;
+export type ReallyMeSignatureKeyPairProtoValue = Readonly<{
+    algorithm: ReallyMeSignatureAlgorithm;
+    keyPair: ReallyMeSignatureKeyPair;
+}>;
+export type ReallyMeKeyAgreementKeyPairProtoValue = Readonly<{
+    algorithm: ReallyMeKeyAgreementAlgorithm;
+    keyPair: ReallyMeKeyAgreementKeyPair;
+}>;
+export type ReallyMeKemKeyPairProtoValue = Readonly<{
+    algorithm: ReallyMeKemAlgorithm;
+    keyPair: ReallyMeKemKeyPair;
+}>;
+export type ReallyMeKemEncapsulationProtoValue = Readonly<{
+    algorithm: ReallyMeKemAlgorithm;
+    encapsulation: ReallyMeKemEncapsulation;
+}>;
+export type ReallyMeHpkeSealedMessageProtoValue = Readonly<{
+    sealedMessage: ReallyMeHpkeSealedMessage;
+    suite: ReallyMeHpkeSuite;
+}>;
+export declare const signatureKeyPairToProto: (algorithm: ReallyMeSignatureAlgorithm, keyPair: ReallyMeSignatureKeyPair) => CryptoKeyPair;
+export declare const signatureKeyPairToProtoBytes: (algorithm: ReallyMeSignatureAlgorithm, keyPair: ReallyMeSignatureKeyPair) => Uint8Array;
+export declare const signatureKeyPairFromProto: (value: CryptoKeyPair) => ReallyMeSignatureKeyPairProtoValue;
+export declare const signatureKeyPairFromProtoBytes: (bytes: Uint8Array) => ReallyMeSignatureKeyPairProtoValue;
+export declare const keyAgreementKeyPairToProto: (algorithm: ReallyMeKeyAgreementAlgorithm, keyPair: ReallyMeKeyAgreementKeyPair) => CryptoKeyPair;
+export declare const keyAgreementKeyPairToProtoBytes: (algorithm: ReallyMeKeyAgreementAlgorithm, keyPair: ReallyMeKeyAgreementKeyPair) => Uint8Array;
+export declare const keyAgreementKeyPairFromProto: (value: CryptoKeyPair) => ReallyMeKeyAgreementKeyPairProtoValue;
+export declare const keyAgreementKeyPairFromProtoBytes: (bytes: Uint8Array) => ReallyMeKeyAgreementKeyPairProtoValue;
+export declare const kemKeyPairToProto: (algorithm: ReallyMeKemAlgorithm, keyPair: ReallyMeKemKeyPair) => CryptoKeyPair;
+export declare const kemKeyPairToProtoBytes: (algorithm: ReallyMeKemAlgorithm, keyPair: ReallyMeKemKeyPair) => Uint8Array;
+export declare const kemKeyPairFromProto: (value: CryptoKeyPair) => ReallyMeKemKeyPairProtoValue;
+export declare const kemKeyPairFromProtoBytes: (bytes: Uint8Array) => ReallyMeKemKeyPairProtoValue;
+export declare const kemEncapsulationToProto: (algorithm: ReallyMeKemAlgorithm, encapsulation: ReallyMeKemEncapsulation) => CryptoKemEncapsulation;
+export declare const kemEncapsulationToProtoBytes: (algorithm: ReallyMeKemAlgorithm, encapsulation: ReallyMeKemEncapsulation) => Uint8Array;
+export declare const kemEncapsulationFromProto: (value: CryptoKemEncapsulation) => ReallyMeKemEncapsulationProtoValue;
+export declare const kemEncapsulationFromProtoBytes: (bytes: Uint8Array) => ReallyMeKemEncapsulationProtoValue;
+export declare const hpkeSealedMessageToProto: (suite: ReallyMeHpkeSuite, sealedMessage: ReallyMeHpkeSealedMessage) => CryptoHpkeSealedMessage;
+export declare const hpkeSealedMessageToProtoBytes: (suite: ReallyMeHpkeSuite, sealedMessage: ReallyMeHpkeSealedMessage) => Uint8Array;
+export declare const hpkeSealedMessageFromProto: (value: CryptoHpkeSealedMessage) => ReallyMeHpkeSealedMessageProtoValue;
+export declare const hpkeSealedMessageFromProtoBytes: (bytes: Uint8Array) => ReallyMeHpkeSealedMessageProtoValue;
+export declare const verificationResultToProto: (algorithm: CryptoAlgorithmIdentifier, valid: boolean) => CryptoVerificationResult;
+export declare const verificationErrorToProto: (algorithm: CryptoAlgorithmIdentifier, error: ReallyMeCryptoError) => CryptoVerificationResult;
+export declare const verificationResultToProtoBytes: (value: CryptoVerificationResult) => Uint8Array;
+export declare const verificationResultFromProtoBytes: (bytes: Uint8Array) => CryptoVerificationResult;
+export declare const providerCapabilityToProto: (value: ReallyMeProviderCapability) => CryptoProviderCapability;
+export declare const providerCapabilityFromProto: (value: CryptoProviderCapability) => ReallyMeProviderCapability;
+export declare const providerCapabilitySetToProto: (values: ReadonlyArray<ReallyMeProviderCapability>) => CryptoProviderCapabilitySet;
+export declare const providerCapabilitySetToProtoBytes: (values: ReadonlyArray<ReallyMeProviderCapability>) => Uint8Array;
+export declare const providerCapabilitySetFromProto: (value: CryptoProviderCapabilitySet) => readonly ReallyMeProviderCapability[];
+export declare const providerCapabilitySetFromProtoBytes: (bytes: Uint8Array) => readonly ReallyMeProviderCapability[];

package/dist/protoValues.js

@@ -0,0 +1,228 @@
+// SPDX-FileCopyrightText: 2026 ReallyMe LLC
+//
+// SPDX-License-Identifier: MIT OR Apache-2.0
+import { create, fromBinary, toBinary } from "@bufbuild/protobuf";
+import { ReallyMeCryptoError } from "./errors.js";
+import { ensureByteArrayAtMost, MAX_CRYPTO_INPUT_LENGTH } from "./validateBytes.js";
+import { cryptoErrorToProto } from "./protoErrors.js";
+import { hpkeSuiteFromIdentifier, hpkeSuiteIdentifierToProto, kemAlgorithmFromIdentifier, kemAlgorithmIdentifierToProto, keyAgreementAlgorithmFromIdentifier, keyAgreementAlgorithmIdentifierToProto, signatureAlgorithmFromIdentifier, signatureAlgorithmIdentifierToProto, } from "./protoIdentifiers.js";
+import { CryptoAlgorithmFamily, CryptoHpkeSealedMessageSchema, CryptoKemEncapsulationSchema, CryptoKeyPairSchema, CryptoProviderCapabilitySchema, CryptoProviderCapabilitySetSchema, CryptoProviderSupportStatus, CryptoVerificationResultSchema, CryptoVerificationStatus, } from "./proto/generated/reallyme/crypto/v1/crypto_pb.js";
+const keyPairToProto = (algorithm, keyPair) => create(CryptoKeyPairSchema, {
+    algorithm,
+    publicKey: keyPair.publicKey,
+    secretKey: keyPair.secretKey,
+});
+export const signatureKeyPairToProto = (algorithm, keyPair) => keyPairToProto(signatureAlgorithmIdentifierToProto(algorithm), keyPair);
+export const signatureKeyPairToProtoBytes = (algorithm, keyPair) => toBinary(CryptoKeyPairSchema, signatureKeyPairToProto(algorithm, keyPair));
+export const signatureKeyPairFromProto = (value) => ({
+    algorithm: signatureAlgorithmFromIdentifier(value.algorithm),
+    keyPair: {
+        publicKey: new Uint8Array(value.publicKey),
+        secretKey: new Uint8Array(value.secretKey),
+    },
+});
+export const signatureKeyPairFromProtoBytes = (bytes) => {
+    try {
+        ensureByteArrayAtMost(bytes, MAX_CRYPTO_INPUT_LENGTH);
+        return signatureKeyPairFromProto(fromBinary(CryptoKeyPairSchema, bytes));
+    }
+    catch (error) {
+        if (error instanceof ReallyMeCryptoError) {
+            throw error;
+        }
+        throw new ReallyMeCryptoError("invalid-input");
+    }
+};
+export const keyAgreementKeyPairToProto = (algorithm, keyPair) => keyPairToProto(keyAgreementAlgorithmIdentifierToProto(algorithm), keyPair);
+export const keyAgreementKeyPairToProtoBytes = (algorithm, keyPair) => toBinary(CryptoKeyPairSchema, keyAgreementKeyPairToProto(algorithm, keyPair));
+export const keyAgreementKeyPairFromProto = (value) => ({
+    algorithm: keyAgreementAlgorithmFromIdentifier(value.algorithm),
+    keyPair: {
+        publicKey: new Uint8Array(value.publicKey),
+        secretKey: new Uint8Array(value.secretKey),
+    },
+});
+export const keyAgreementKeyPairFromProtoBytes = (bytes) => {
+    try {
+        ensureByteArrayAtMost(bytes, MAX_CRYPTO_INPUT_LENGTH);
+        return keyAgreementKeyPairFromProto(fromBinary(CryptoKeyPairSchema, bytes));
+    }
+    catch (error) {
+        if (error instanceof ReallyMeCryptoError) {
+            throw error;
+        }
+        throw new ReallyMeCryptoError("invalid-input");
+    }
+};
+export const kemKeyPairToProto = (algorithm, keyPair) => keyPairToProto(kemAlgorithmIdentifierToProto(algorithm), keyPair);
+export const kemKeyPairToProtoBytes = (algorithm, keyPair) => toBinary(CryptoKeyPairSchema, kemKeyPairToProto(algorithm, keyPair));
+export const kemKeyPairFromProto = (value) => ({
+    algorithm: kemAlgorithmFromIdentifier(value.algorithm),
+    keyPair: {
+        publicKey: new Uint8Array(value.publicKey),
+        secretKey: new Uint8Array(value.secretKey),
+    },
+});
+export const kemKeyPairFromProtoBytes = (bytes) => {
+    try {
+        ensureByteArrayAtMost(bytes, MAX_CRYPTO_INPUT_LENGTH);
+        return kemKeyPairFromProto(fromBinary(CryptoKeyPairSchema, bytes));
+    }
+    catch (error) {
+        if (error instanceof ReallyMeCryptoError) {
+            throw error;
+        }
+        throw new ReallyMeCryptoError("invalid-input");
+    }
+};
+export const kemEncapsulationToProto = (algorithm, encapsulation) => create(CryptoKemEncapsulationSchema, {
+    algorithm: kemAlgorithmIdentifierToProto(algorithm),
+    ciphertext: encapsulation.ciphertext,
+    sharedSecret: encapsulation.sharedSecret,
+});
+export const kemEncapsulationToProtoBytes = (algorithm, encapsulation) => toBinary(CryptoKemEncapsulationSchema, kemEncapsulationToProto(algorithm, encapsulation));
+export const kemEncapsulationFromProto = (value) => ({
+    algorithm: kemAlgorithmFromIdentifier(value.algorithm),
+    encapsulation: {
+        ciphertext: new Uint8Array(value.ciphertext),
+        sharedSecret: new Uint8Array(value.sharedSecret),
+    },
+});
+export const kemEncapsulationFromProtoBytes = (bytes) => {
+    try {
+        ensureByteArrayAtMost(bytes, MAX_CRYPTO_INPUT_LENGTH);
+        return kemEncapsulationFromProto(fromBinary(CryptoKemEncapsulationSchema, bytes));
+    }
+    catch (error) {
+        if (error instanceof ReallyMeCryptoError) {
+            throw error;
+        }
+        throw new ReallyMeCryptoError("invalid-input");
+    }
+};
+export const hpkeSealedMessageToProto = (suite, sealedMessage) => create(CryptoHpkeSealedMessageSchema, {
+    algorithm: hpkeSuiteIdentifierToProto(suite),
+    encapsulatedKey: sealedMessage.encapsulatedKey,
+    ciphertext: sealedMessage.ciphertext,
+});
+export const hpkeSealedMessageToProtoBytes = (suite, sealedMessage) => toBinary(CryptoHpkeSealedMessageSchema, hpkeSealedMessageToProto(suite, sealedMessage));
+export const hpkeSealedMessageFromProto = (value) => ({
+    suite: hpkeSuiteFromIdentifier(value.algorithm),
+    sealedMessage: {
+        encapsulatedKey: new Uint8Array(value.encapsulatedKey),
+        ciphertext: new Uint8Array(value.ciphertext),
+    },
+});
+export const hpkeSealedMessageFromProtoBytes = (bytes) => {
+    try {
+        ensureByteArrayAtMost(bytes, MAX_CRYPTO_INPUT_LENGTH);
+        return hpkeSealedMessageFromProto(fromBinary(CryptoHpkeSealedMessageSchema, bytes));
+    }
+    catch (error) {
+        if (error instanceof ReallyMeCryptoError) {
+            throw error;
+        }
+        throw new ReallyMeCryptoError("invalid-input");
+    }
+};
+export const verificationResultToProto = (algorithm, valid) => create(CryptoVerificationResultSchema, {
+    algorithm,
+    status: valid ? CryptoVerificationStatus.VALID : CryptoVerificationStatus.INVALID,
+});
+export const verificationErrorToProto = (algorithm, error) => create(CryptoVerificationResultSchema, {
+    algorithm,
+    status: CryptoVerificationStatus.ERROR,
+    error: cryptoErrorToProto(error),
+});
+export const verificationResultToProtoBytes = (value) => toBinary(CryptoVerificationResultSchema, value);
+export const verificationResultFromProtoBytes = (bytes) => {
+    try {
+        ensureByteArrayAtMost(bytes, MAX_CRYPTO_INPUT_LENGTH);
+        const value = fromBinary(CryptoVerificationResultSchema, bytes);
+        if (value.algorithm?.algorithm.case === undefined) {
+            throw new ReallyMeCryptoError("invalid-input");
+        }
+        // Require an explicit outcome, and prevent a success or invalid result
+        // from masking a structured processing error.
+        switch (value.status) {
+            case CryptoVerificationStatus.VALID:
+            case CryptoVerificationStatus.INVALID:
+                if (value.error !== undefined) {
+                    throw new ReallyMeCryptoError("invalid-input");
+                }
+                break;
+            case CryptoVerificationStatus.ERROR:
+                if (value.error?.error.case === undefined) {
+                    throw new ReallyMeCryptoError("invalid-input");
+                }
+                break;
+            default:
+                throw new ReallyMeCryptoError("invalid-input");
+        }
+        return value;
+    }
+    catch {
+        throw new ReallyMeCryptoError("invalid-input");
+    }
+};
+const providerSupportStatusToProto = (value) => {
+    switch (value) {
+        case "partial":
+            return CryptoProviderSupportStatus.PARTIAL;
+        case "provider-aware":
+            return CryptoProviderSupportStatus.PROVIDER_AWARE;
+        case "supported":
+            return CryptoProviderSupportStatus.SUPPORTED;
+        case "unsupported":
+            return CryptoProviderSupportStatus.UNSUPPORTED;
+    }
+};
+const providerSupportStatusFromProto = (value) => {
+    switch (value) {
+        case CryptoProviderSupportStatus.PARTIAL:
+            return "partial";
+        case CryptoProviderSupportStatus.PROVIDER_AWARE:
+            return "provider-aware";
+        case CryptoProviderSupportStatus.SUPPORTED:
+            return "supported";
+        case CryptoProviderSupportStatus.UNSUPPORTED:
+            return "unsupported";
+        default:
+            throw new ReallyMeCryptoError("invalid-input");
+    }
+};
+export const providerCapabilityToProto = (value) => create(CryptoProviderCapabilitySchema, {
+    algorithm: value.algorithm,
+    family: value.family,
+    providerNames: [...value.providerNames],
+    status: providerSupportStatusToProto(value.status),
+    usesRust: value.usesRust,
+});
+export const providerCapabilityFromProto = (value) => {
+    if (value.algorithm === undefined || value.family === CryptoAlgorithmFamily.UNSPECIFIED) {
+        throw new ReallyMeCryptoError("invalid-input");
+    }
+    return {
+        algorithm: value.algorithm,
+        family: value.family,
+        providerNames: [...value.providerNames],
+        status: providerSupportStatusFromProto(value.status),
+        usesRust: value.usesRust,
+    };
+};
+export const providerCapabilitySetToProto = (values) => create(CryptoProviderCapabilitySetSchema, {
+    capabilities: values.map((value) => providerCapabilityToProto(value)),
+});
+export const providerCapabilitySetToProtoBytes = (values) => toBinary(CryptoProviderCapabilitySetSchema, providerCapabilitySetToProto(values));
+export const providerCapabilitySetFromProto = (value) => value.capabilities.map((capability) => providerCapabilityFromProto(capability));
+export const providerCapabilitySetFromProtoBytes = (bytes) => {
+    try {
+        return providerCapabilitySetFromProto(fromBinary(CryptoProviderCapabilitySetSchema, bytes));
+    }
+    catch (error) {
+        if (error instanceof ReallyMeCryptoError) {
+            throw error;
+        }
+        throw new ReallyMeCryptoError("invalid-input");
+    }
+};

package/dist/providerCatalog.js

@@ -1,4 +1,4 @@
-// SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
+// SPDX-FileCopyrightText: 2026 ReallyMe LLC
 //
 // SPDX-License-Identifier: MIT OR Apache-2.0
 /** Providers compiled into the TypeScript package. */

package/dist/rsa.js

@@ -1,4 +1,4 @@
-// SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
+// SPDX-FileCopyrightText: 2026 ReallyMe LLC
 //
 // SPDX-License-Identifier: MIT OR Apache-2.0
 import { ReallyMeCryptoError } from "./errors.js";

package/dist/secp256k1.js

@@ -1,4 +1,4 @@
-// SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
+// SPDX-FileCopyrightText: 2026 ReallyMe LLC
 //
 // SPDX-License-Identifier: MIT OR Apache-2.0
 import { secp256k1 } from "@noble/curves/secp256k1.js";

package/dist/slhDsa.js

@@ -1,4 +1,4 @@
-// SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
+// SPDX-FileCopyrightText: 2026 ReallyMe LLC
 //
 // SPDX-License-Identifier: MIT OR Apache-2.0
 import { ReallyMeCryptoError } from "./errors.js";

package/dist/validateBytes.js

@@ -1,4 +1,4 @@
-// SPDX-FileCopyrightText: Copyright © 2026 ReallyMe LLC. All rights reserved
+// SPDX-FileCopyrightText: 2026 ReallyMe LLC
 //
 // SPDX-License-Identifier: MIT OR Apache-2.0
 import { ReallyMeCryptoError } from "./errors.js";